Your own Stripe

#How it works

This is for a server that takes money through its own Stripe account. It is kept apart from how you pay us: a different account, a different address, and no API key.

Stripe signs every webhook with the endpoint signing secret. We check the signature and the time on it, and refuse anything that does not match or is more than five minutes old.

We keep the payment intent id, the amount, the currency, the package name and the player UUID. No card data ever reaches us.

#Setting it up

• In Settings, Integrations, press Add store, pick Stripe and name it. Copy the webhook address it shows.
• In your Stripe dashboard open Developers, then Webhooks, and add an endpoint with that address.
• Pick the events checkout.session.completed, checkout.session.async_payment_succeeded, invoice.paid, charge.refunded and charge.dispute.created.
• Copy the signing secret, which starts with whsec_, into the store row and press Save secret.
• Send a test event from Stripe. It shows on the store row as the first event.

#Metadata your checkout sets

Set these keys on the Checkout Session metadata. For a subscription, set them on subscription_data.metadata instead, so every renewal carries them. On a payment link, put the UUID in client_reference_id.

await stripe.checkout.sessions.create({
  mode: "payment",
  line_items: [{ price: "price_vip", quantity: 1 }],
  metadata: {
    minecraft_uuid: player.uuid,
    package: "VIP Rank",
  },
  success_url: "https://store.example.net/thanks",
});

#Limits

• A full refund takes the sale off. A partial refund leaves the sale counted in full.
• A dispute marks the sale as a chargeback.
• A refund on a subscription renewal is matched only when the invoice webhook carries its payment intent, which newer Stripe API versions leave out.
• A username in metadata is never used to match. Without a UUID the sale still counts, in Unmatched.
• Past sales are not imported. Revenue starts with the first delivery after you connect.